apiVersion: v1 items: - apiVersion: kuadrant.io/v1 kind: AuthPolicy metadata: creationTimestamp: "2026-10-30T23:45:15Z" generation: 1 labels: ai-gateway-controller.opendatahub.io/consumer-portal-instance: models-as-a-service app.kubernetes.io/managed-by: ai-gateway-controller app.kubernetes.io/name: maas-consumer-portal-oauth2 app.kubernetes.io/part-of: maas-consumer-portal name: maas-consumer-portal-oauth2-anonymous namespace: odh-ai-gateway-infra resourceVersion: "20198" uid: 32123fce-04e1-4949-8f53-e49b684bc09b spec: rules: authentication: public-login: anonymous: {} metrics: false priority: 0 targetRef: group: gateway.networking.k8s.io kind: HTTPRoute name: maas-consumer-portal-oauth2 status: conditions: - lastTransitionTime: "2026-10-30T23:45:16Z" message: AuthPolicy has been accepted reason: Accepted status: "True" type: Accepted - lastTransitionTime: "2026-10-30T23:45:17Z" message: AuthPolicy has been successfully enforced reason: Enforced status: "True" type: Enforced observedGeneration: 1 - apiVersion: kuadrant.io/v1 kind: AuthPolicy metadata: creationTimestamp: "2026-10-30T23:45:15Z" generation: 1 labels: ai-gateway-controller.opendatahub.io/consumer-portal-instance: models-as-a-service app.kubernetes.io/managed-by: ai-gateway-controller app.kubernetes.io/name: maas-consumer-portal app.kubernetes.io/part-of: maas-consumer-portal name: maas-consumer-portal-session namespace: odh-ai-gateway-infra resourceVersion: "20199" uid: 96b6f196-8f03-4f64-88b2-4e46f4b4b7e7 spec: rules: authentication: browser: anonymous: {} metrics: false priority: 0 authorization: require-session: metrics: false patternMatching: patterns: - predicate: auth.authorization.session.identity.access_token != "" priority: 1 session: metrics: false opa: allValues: true rego: | allow = true login_location := sprintf("/oauth2/start?rd=%s", [urlquery.encode(input.context.request.http.path)]) identity = result { cookie := object.get(input.context.request.http.headers, "cookie", "") cookie != "" response := http.send({ "method": "GET", "url": "https://maas-consumer-portal-auth-proxy.odh-ai-gateway-infra.svc.cluster.local:4180/oauth2/auth", "headers": {"Cookie": cookie}, "tls_ca_cert_file": "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt", "timeout": "2s", "cache": false, "enable_redirect": false, "raise_error": false }) {200, 202}[response.status_code] token := object.get(response.headers, "x-auth-request-access-token", [""])[0] token != "" result := {"access_token": token} } else = {"access_token": ""} priority: 0 response: success: headers: x-forwarded-access-token: metrics: false plain: expression: auth.authorization.session.identity.access_token priority: 0 unauthorized: code: 302 headers: Cache-Control: value: no-store Location: expression: auth.authorization.session.login_location message: value: Redirecting to login targetRef: group: gateway.networking.k8s.io kind: HTTPRoute name: maas-consumer-portal status: conditions: - lastTransitionTime: "2026-10-30T23:45:16Z" message: AuthPolicy has been accepted reason: Accepted status: "True" type: Accepted - lastTransitionTime: "2026-10-30T23:45:17Z" message: AuthPolicy has been successfully enforced reason: Enforced status: "True" type: Enforced observedGeneration: 1 - apiVersion: kuadrant.io/v1 kind: AuthPolicy metadata: creationTimestamp: "2026-10-30T23:43:03Z" generation: 2 labels: app.kubernetes.io/component: gateway-auth app.kubernetes.io/managed-by: maas-controller app.kubernetes.io/part-of: maas-gateway-auth name: maas-gateway-auth namespace: openshift-ingress ownerReferences: - apiVersion: gateway.networking.k8s.io/v1 controller: true kind: Gateway name: maas-default-gateway uid: 45dec36b-c3f0-44c7-8ed3-9ddd059848ce resourceVersion: "29866" uid: 9ec70887-bcfa-45bb-8d73-a35570cabbab spec: defaults: rules: authentication: api-keys: metrics: false plain: selector: request.headers.authorization priority: 0 when: - operator: matches selector: request.headers.authorization value: ^Bearer **** oidc-identities: jwt: issuerUrl: https://keycloak.apps.21f1608424d0b6687efa.prod.konflux-ocp-ci.dev/realms/tenant-a ttl: 300 metrics: false priority: 1 when: - predicate: '!request.headers.authorization.startsWith("Bearer ****") && request.headers.authorization.matches("^Bearer ****\\.[^.]+\\.[^.]+$")' openshift-identities: kubernetesTokenReview: audiences: - https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/c3c92 metrics: false priority: 2 authorization: auth-valid: cache: key: selector: '"api-key|" + (request.headers.authorization.replace("Bearer ", "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))' ttl: 60 metrics: false opa: allValues: false rego: |- allow { object.get(input.auth.metadata, "apiKeyValidation", {}) input.auth.metadata.apiKeyValidation.valid == true } allow { not input.auth.metadata.apiKeyValidation } priority: 0 deny-api-key-management: metrics: false patternMatching: patterns: - predicate: "false" priority: 0 when: - predicate: (request.headers.authorization.matches("^Bearer ****")) && (request.path == "/maas-api/v1/api-keys" || request.path.startsWith("/maas-api/v1/api-keys/")) deny-client-identity-headers: metrics: false patternMatching: patterns: - predicate: '!("x-maas-username" in request.headers)' - predicate: '!("x-maas-group" in request.headers)' - predicate: '!("x-maas-keyname" in request.headers)' - predicate: '!("x-maas-subscription-rate-limit-id" in request.headers)' - predicate: '!("x-maas-organization-id" in request.headers)' - predicate: '!("x-maas-cost-center" in request.headers)' - predicate: '!("x-maas-identity" in request.headers)' - predicate: '!("x-maas-admin-scope" in request.headers)' - predicate: request.headers.all(name, !name.startsWith("x-aigateway-guardrail-")) - predicate: request.headers.all(name, !name.startsWith("x-grid-")) priority: 0 guardrail-checks-known: metrics: false opa: allValues: false rego: | import future.keywords.every allow { selected := object.get(input.auth.metadata["subscription-info"], "selectedGuardrailChecks", null) selected != null every id, value in selected { id in [] value == true } } priority: 0 when: - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers) oidc-client-bound: metrics: false patternMatching: patterns: - operator: eq selector: auth.identity.iss value: https://keycloak.apps.21f1608424d0b6687efa.prod.konflux-ocp-ci.dev/realms/tenant-a - operator: eq selector: auth.identity.azp value: test-client - predicate: has(auth.identity.aud) && (auth.identity.aud == "maas-api" || "maas-api" in auth.identity.aud) - operator: eq selector: auth.identity.token_use value: access priority: 1 when: - predicate: '!request.headers.authorization.startsWith("Bearer ****") && request.headers.authorization.matches("^Bearer ****\\.[^.]+\\.[^.]+$") && has(auth.identity.iss)' oidc-groups-safe: metrics: false opa: allValues: false rego: "unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:#._/ -]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}" priority: 0 when: - predicate: '!request.headers.authorization.startsWith("Bearer ****") && has(auth.identity.groups) && size(auth.identity.groups) > 0' require-group-membership: cache: key: selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))' ttl: 60 metrics: false opa: allValues: false rego: |- allow { object.get(input.auth.metadata["subscription-info"], "accessAllowed", false) == true } priority: 0 when: - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers) subscription-valid: cache: key: selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))' ttl: 60 metrics: false opa: allValues: false rego: "allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}" priority: 0 when: - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers) metadata: apiKeyValidation: cache: key: selector: auth.identity.replace("Bearer ", "") ttl: 60 http: body: expression: '{"key": auth.identity.replace("Bearer ", "")}' contentType: application/json method: POST url: https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate metrics: false priority: 0 when: - predicate: auth.identity.matches("^(Bearer ****") subscription-info: cache: key: selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))' ttl: 60 http: body: expression: |- { "groups": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])), "username": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)), "requestedSubscription": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : ""), "requestedModel": (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : "")) } contentType: application/json method: POST url: https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select metrics: false priority: 1 when: - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers) response: success: filters: identity: json: properties: groups: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))' groups_str: expression: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",")' keyId: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : ""' keyName: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : ""' selected_subscription: expression: 'has(auth.metadata["subscription-info"].name) ? auth.metadata["subscription-info"].name : ""' selected_subscription_id: expression: 'has(auth.metadata["subscription-info"].rateLimitId) ? auth.metadata["subscription-info"].rateLimitId : ""' selected_subscription_key: expression: '(has(auth.metadata["subscription-info"].namespace) && has(auth.metadata["subscription-info"].name)) ? auth.metadata["subscription-info"].namespace + "/" + auth.metadata["subscription-info"].name + "@" + (has(auth.metadata["subscription-info"].resolvedModel) && auth.metadata["subscription-info"].resolvedModel != "" ? auth.metadata["subscription-info"].resolvedModel : (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))) : ""' subscription_error: expression: 'has(auth.metadata["subscription-info"].error) ? auth.metadata["subscription-info"].error : ""' subscription_error_message: expression: 'has(auth.metadata["subscription-info"].message) ? auth.metadata["subscription-info"].message : ""' subscription_info: expression: 'has(auth.metadata["subscription-info"].name) ? auth.metadata["subscription-info"] : {}' userid: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))' metrics: true priority: 0 when: - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers) headers: X-MaaS-Cost-Center: metrics: false plain: expression: auth.metadata["subscription-info"].costCenter priority: 0 when: - predicate: has(auth.metadata["subscription-info"].costCenter) && auth.metadata["subscription-info"].costCenter != "" X-MaaS-Group: metrics: false plain: expression: 'size(auth.metadata.apiKeyValidation.groups) > 0 ? ''["'' + auth.metadata.apiKeyValidation.groups.join(''","'') + ''"]'' : ''[]''' priority: 0 when: - predicate: request.headers.authorization.matches("^Bearer ****") X-MaaS-Group-Token: key: X-MaaS-Group metrics: false plain: expression: 'has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? ''["system:authenticated","'' + auth.identity.groups.join(''","'') + ''"]'' : ''["system:authenticated"]'') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? ''["system:authenticated","'' + auth.identity.user.groups.join(''","'') + ''"]'' : ''["system:authenticated"]'')' priority: 1 when: - predicate: '!request.headers.authorization.startsWith("Bearer ****")' X-MaaS-Identity: json: properties: claims: expression: '{"iss": auth.identity.iss, "sub": auth.identity.sub, "aud": auth.identity.aud, "azp": auth.identity.azp, "name": has(auth.identity.name) ? auth.identity.name : "", "given_name": has(auth.identity.given_name) ? auth.identity.given_name : "", "family_name": has(auth.identity.family_name) ? auth.identity.family_name : "", "preferred_username": has(auth.identity.preferred_username) ? auth.identity.preferred_username : "", "email": has(auth.identity.email) ? auth.identity.email : "", "groups": has(auth.identity.groups) ? auth.identity.groups : [], "https://redhat.com/maas/orgs": "https://redhat.com/maas/orgs" in auth.identity ? auth.identity["https://redhat.com/maas/orgs"] : []}' source: value: oidc metrics: false priority: 0 when: - predicate: |- (request.path == "/v1/me" || request.path == "/maas-api/v1/me" || request.path == "/v1/subscriptions" || request.path.startsWith("/v1/subscriptions/") || request.path.startsWith("/v1/model/") && request.path.endsWith("/subscriptions") || request.path.startsWith("/v1/api-keys") || request.path.startsWith("/maas-api/v1/subscriptions") || request.path.startsWith("/maas-api/v1/model/") && request.path.endsWith("/subscriptions") || request.path.startsWith("/maas-api/v1/api-keys")) && (!request.headers.authorization.startsWith("Bearer ****") && request.headers.authorization.matches("^Bearer ****\\.[^.]+\\.[^.]+$") && has(auth.identity.iss)) X-MaaS-KeyName: key: x-maas-keyname metrics: false plain: expression: auth.metadata.apiKeyValidation.keyName priority: 0 when: - predicate: request.headers.authorization.matches("^Bearer ****") X-MaaS-Subscription: metrics: false plain: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : "")' priority: 0 when: - predicate: has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != "" X-MaaS-Subscription-Rate-Limit-Id: metrics: false plain: expression: auth.metadata["subscription-info"].rateLimitId priority: 0 when: - predicate: has(auth.metadata["subscription-info"].rateLimitId) && auth.metadata["subscription-info"].rateLimitId != "" X-MaaS-Username: metrics: false plain: selector: auth.metadata.apiKeyValidation.username priority: 0 when: - predicate: request.headers.authorization.matches("^Bearer ****") X-MaaS-Username-Token: key: X-MaaS-Username metrics: false plain: expression: 'has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)' priority: 1 when: - predicate: '!request.headers.authorization.startsWith("Bearer ****")' x-gateway-inference-fairness-id: metrics: false plain: expression: 'has(auth.metadata) && "subscription-info" in auth.metadata && has(auth.metadata["subscription-info"].fairnessId) ? auth.metadata["subscription-info"].fairnessId : ""' priority: 0 x-gateway-inference-objective: metrics: false plain: expression: 'has(auth.metadata) && "subscription-info" in auth.metadata && has(auth.metadata["subscription-info"].objective) ? auth.metadata["subscription-info"].objective : ""' priority: 0 x-llm-d-inference-fairness-id: metrics: false plain: expression: 'has(auth.metadata) && "subscription-info" in auth.metadata && has(auth.metadata["subscription-info"].fairnessId) ? auth.metadata["subscription-info"].fairnessId : ""' priority: 0 x-llm-d-inference-objective: metrics: false plain: expression: 'has(auth.metadata) && "subscription-info" in auth.metadata && has(auth.metadata["subscription-info"].objective) ? auth.metadata["subscription-info"].objective : ""' priority: 0 x-maas-organization-id: metrics: false plain: expression: 'has(auth.metadata) && "subscription-info" in auth.metadata && has(auth.metadata["subscription-info"].organizationId) ? auth.metadata["subscription-info"].organizationId : ""' priority: 0 unauthenticated: body: value: '{"error":{"message":"Authentication required","type":"authentication_error","code":401}}' code: 401 headers: content-type: value: application/json message: value: Authentication required unauthorized: body: expression: '''{"error":{"message":"'' + (has(auth.metadata["subscription-info"].message) ? auth.metadata["subscription-info"].message.replace(''\\'', ''\\\\'').replace(''"'', ''\\"'').replace(''\n'', ''\\n'').replace(''\r'', ''\\r'').replace(''\t'', ''\\t'') : "Access denied") + ''","type":"authorization_error","code":403}}''' code: 403 headers: content-type: value: application/json x-ext-auth-reason: expression: 'has(auth.metadata["subscription-info"].error) ? auth.metadata["subscription-info"].error : "unauthorized"' strategy: atomic when: - predicate: request.path != "/maas-api/health" || request.method != "GET" targetRef: group: gateway.networking.k8s.io kind: Gateway name: maas-default-gateway status: conditions: - lastTransitionTime: "2026-10-30T23:43:03Z" message: AuthPolicy has been accepted reason: Accepted status: "True" type: Accepted - lastTransitionTime: "2026-10-30T23:51:38Z" message: AuthPolicy has been partially enforced reason: Enforced status: "True" type: Enforced observedGeneration: 2 - apiVersion: kuadrant.io/v1 kind: AuthPolicy metadata: creationTimestamp: "2026-10-30T23:42:21Z" generation: 1 labels: app.kubernetes.io/component: llminferenceservice-policies app.kubernetes.io/managed-by: odh-model-controller app.kubernetes.io/name: llminferenceservice-auth app.kubernetes.io/part-of: llminferenceservice name: openshift-ai-inference-authn namespace: openshift-ingress ownerReferences: - apiVersion: gateway.networking.k8s.io/v1 blockOwnerDeletion: true controller: true kind: Gateway name: openshift-ai-inference uid: 18364d7f-bf9e-4079-932a-eb3990483660 resourceVersion: "17296" uid: 8e123ae9-7d39-4ea3-952a-83721b9aa75c spec: patterns: has-ns-and-name: allOf: - operator: matches selector: context.request.http.path value: ^/[^/]+/[^/]+ is-publisher-path: allOf: - operator: matches selector: context.request.http.path value: ^/publishers/[^/]+/models/ rules: authentication: kubernetes-user: credentials: ****REDACTED**** kubernetesTokenReview: audiences: - https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/c3c92 metrics: false overrides: fairness: value: https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/c3c92 objective: expression: 'auth.identity.user.username.startsWith(''system:serviceaccount:'') ? auth.identity.user.username.split('':'')[2] : ''authenticated''' resolvedGroups: expression: |- 'x-maas-user' in request.headers ? ('x-maas-groups' in request.headers ? request.headers['x-maas-groups'].split(',') : []) : auth.identity.user.groups resolvedUser: expression: '''x-maas-user'' in request.headers ? request.headers[''x-maas-user''] : auth.identity.user.username' priority: 0 authorization: deny-misrouted-model-header: metrics: false patternMatching: patterns: - predicate: "false" priority: 0 when: - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')' - predicate: '!(request.path == ''/v1/files'' || request.path.startsWith(''/v1/files/'') || request.path == ''/v1/batches'' || request.path.startsWith(''/v1/batches/''))' - predicate: '''x-gateway-model-name'' in request.headers && request.headers[''x-gateway-model-name''].matches(''^publishers/[^/]+/models/.+$'')' inference-access: kubernetesSubjectAccessReview: authorizationGroups: expression: auth.identity.resolvedGroups resourceAttributes: group: value: serving.kserve.io name: expression: request.path.split("/")[2] namespace: expression: request.path.split("/")[1] resource: value: llminferenceservices subresource: {} verb: value: get user: expression: auth.identity.resolvedUser metrics: false priority: 1 when: - patternRef: has-ns-and-name - predicate: '!request.path.startsWith(''/v1/'')' - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')' inference-access-delegate: kubernetesSubjectAccessReview: authorizationGroups: expression: auth.identity.user.groups resourceAttributes: group: value: serving.kserve.io name: expression: request.path.split("/")[2] namespace: expression: request.path.split("/")[1] resource: value: llminferenceservices/delegate subresource: {} verb: value: post-delegate user: expression: auth.identity.user.username metrics: false priority: 1 when: - patternRef: has-ns-and-name - predicate: '!request.path.startsWith(''/v1/'')' - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')' - predicate: '''x-maas-user'' in request.headers' model-access-path: kubernetesSubjectAccessReview: authorizationGroups: expression: auth.identity.resolvedGroups resourceAttributes: group: value: serving.opendatahub.io name: expression: '''publishers/'' + request.path.split(''/'')[2] + ''/models/'' + request.path.split(''/models/'')[1].split(''/v1/'')[0]' namespace: expression: request.path.split('/')[2] resource: value: models subresource: {} verb: value: post user: expression: auth.identity.resolvedUser metrics: false priority: 1 when: - patternRef: is-publisher-path model-access-path-delegate: kubernetesSubjectAccessReview: authorizationGroups: expression: auth.identity.user.groups resourceAttributes: group: value: serving.opendatahub.io name: expression: '''publishers/'' + request.path.split(''/'')[2] + ''/models/'' + request.path.split(''/models/'')[1].split(''/v1/'')[0]' namespace: expression: request.path.split('/')[2] resource: value: models/delegate subresource: {} verb: value: post-delegate user: expression: auth.identity.user.username metrics: false priority: 1 when: - patternRef: is-publisher-path - predicate: '''x-maas-user'' in request.headers' response: success: headers: x-gateway-inference-fairness-id: metrics: false plain: expression: auth.identity.fairness priority: 0 x-gateway-inference-objective: metrics: false plain: expression: auth.identity.objective priority: 0 x-maas-groups: metrics: false plain: expression: auth.identity.user.groups.join(',') priority: 0 when: - predicate: request.path == '/v1/files' || request.path.startsWith('/v1/files/') || request.path == '/v1/batches' || request.path.startsWith('/v1/batches/') x-maas-user: metrics: false plain: expression: auth.identity.user.username priority: 0 when: - predicate: request.path == '/v1/files' || request.path.startsWith('/v1/files/') || request.path == '/v1/batches' || request.path.startsWith('/v1/batches/') x-tenant-id: metrics: false plain: expression: 'auth.identity.user.username.startsWith(''system:serviceaccount:'') ? auth.identity.user.username.split('':'')[2] : ''default''' priority: 0 when: - predicate: request.path.startsWith('/v1/') x-user-id: metrics: false plain: expression: auth.identity.user.username priority: 0 when: - predicate: request.path.startsWith('/v1/') targetRef: group: gateway.networking.k8s.io kind: Gateway name: openshift-ai-inference status: conditions: - lastTransitionTime: "2026-10-30T23:42:21Z" message: AuthPolicy has been accepted reason: Accepted status: "True" type: Accepted - lastTransitionTime: "2026-10-30T23:42:21Z" message: AuthPolicy is not in the path to any existing routes reason: Unknown status: "False" type: Enforced observedGeneration: 1 kind: List metadata: resourceVersion: ""