---
apiVersion: authorino.kuadrant.io/v1beta3
kind: AuthConfig
metadata:
  annotations:
    HTTPRouteRule.gateway.networking.k8s.io: httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-path
  creationTimestamp: "2026-10-30T09:03:39Z"
  generation: 1
  labels:
    kuadrant.io/auth: "true"
    kuadrant.io/managed: "true"
  managedFields:
  - apiVersion: authorino.kuadrant.io/v1beta3
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        .: {}
        f:conditions: {}
        f:summary:
          .: {}
          f:festivalWristbandEnabled: {}
          f:hostsReady: {}
          f:numAuthorizationPolicies: {}
          f:numHostsReady: {}
          f:numIdentitySources: {}
          f:numMetadataSources: {}
          f:numResponseItems: {}
          f:ready: {}
    manager: authorino
    operation: Update
    subresource: status
    time: "2026-10-30T09:03:39Z"
  - apiVersion: authorino.kuadrant.io/v1beta3
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:HTTPRouteRule.gateway.networking.k8s.io: {}
        f:labels:
          .: {}
          f:kuadrant.io/auth: {}
          f:kuadrant.io/managed: {}
      f:spec:
        .: {}
        f:authentication:
          .: {}
          f:api-keys:
            .: {}
            f:credentials: {}
            f:metrics: {}
            f:plain:
              .: {}
              f:selector: {}
            f:priority: {}
            f:when: {}
          f:oidc-identities:
            .: {}
            f:credentials: {}
            f:jwt:
              .: {}
              f:issuerUrl: {}
              f:ttl: {}
            f:metrics: {}
            f:priority: {}
            f:when: {}
          f:openshift-identities:
            .: {}
            f:credentials: {}
            f:kubernetesTokenReview:
              .: {}
              f:audiences: {}
            f:metrics: {}
            f:priority: {}
        f:authorization:
          .: {}
          f:auth-valid:
            .: {}
            f:cache:
              .: {}
              f:key:
                .: {}
                f:selector: {}
              f:ttl: {}
            f:metrics: {}
            f:opa:
              .: {}
              f:allValues: {}
              f:rego: {}
            f:priority: {}
          f:deny-api-key-management:
            .: {}
            f:metrics: {}
            f:patternMatching:
              .: {}
              f:patterns: {}
            f:priority: {}
            f:when: {}
          f:deny-client-identity-headers:
            .: {}
            f:metrics: {}
            f:patternMatching:
              .: {}
              f:patterns: {}
            f:priority: {}
          f:guardrail-checks-known:
            .: {}
            f:metrics: {}
            f:opa:
              .: {}
              f:allValues: {}
              f:rego: {}
            f:priority: {}
            f:when: {}
          f:oidc-client-bound:
            .: {}
            f:metrics: {}
            f:patternMatching:
              .: {}
              f:patterns: {}
            f:priority: {}
            f:when: {}
          f:oidc-groups-safe:
            .: {}
            f:metrics: {}
            f:opa:
              .: {}
              f:allValues: {}
              f:rego: {}
            f:priority: {}
            f:when: {}
          f:require-group-membership:
            .: {}
            f:cache:
              .: {}
              f:key:
                .: {}
                f:selector: {}
              f:ttl: {}
            f:metrics: {}
            f:opa:
              .: {}
              f:allValues: {}
              f:rego: {}
            f:priority: {}
            f:when: {}
          f:subscription-valid:
            .: {}
            f:cache:
              .: {}
              f:key:
                .: {}
                f:selector: {}
              f:ttl: {}
            f:metrics: {}
            f:opa:
              .: {}
              f:allValues: {}
              f:rego: {}
            f:priority: {}
            f:when: {}
        f:hosts: {}
        f:metadata:
          .: {}
          f:apiKeyValidation:
            .: {}
            f:cache:
              .: {}
              f:key:
                .: {}
                f:selector: {}
              f:ttl: {}
            f:http:
              .: {}
              f:body:
                .: {}
                f:expression: {}
              f:contentType: {}
              f:credentials: {}
              f:method: {}
              f:url: {}
            f:metrics: {}
            f:priority: {}
            f:when: {}
          f:subscription-info:
            .: {}
            f:cache:
              .: {}
              f:key:
                .: {}
                f:selector: {}
              f:ttl: {}
            f:http:
              .: {}
              f:body:
                .: {}
                f:expression: {}
              f:contentType: {}
              f:credentials: {}
              f:method: {}
              f:url: {}
            f:metrics: {}
            f:priority: {}
            f:when: {}
        f:response:
          .: {}
          f:success:
            .: {}
            f:dynamicMetadata:
              .: {}
              f:identity:
                .: {}
                f:json:
                  .: {}
                  f:properties:
                    .: {}
                    f:groups:
                      .: {}
                      f:expression: {}
                    f:groups_str:
                      .: {}
                      f:expression: {}
                    f:keyId:
                      .: {}
                      f:expression: {}
                    f:keyName:
                      .: {}
                      f:expression: {}
                    f:selected_subscription:
                      .: {}
                      f:expression: {}
                    f:selected_subscription_id:
                      .: {}
                      f:expression: {}
                    f:selected_subscription_key:
                      .: {}
                      f:expression: {}
                    f:subscription_error:
                      .: {}
                      f:expression: {}
                    f:subscription_error_message:
                      .: {}
                      f:expression: {}
                    f:subscription_info:
                      .: {}
                      f:expression: {}
                    f:userid:
                      .: {}
                      f:expression: {}
                f:metrics: {}
                f:priority: {}
                f:when: {}
            f:headers:
              .: {}
              f:X-MaaS-Cost-Center:
                .: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:expression: {}
                f:priority: {}
                f:when: {}
              f:X-MaaS-Group:
                .: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:expression: {}
                f:priority: {}
                f:when: {}
              f:X-MaaS-Group-Token:
                .: {}
                f:key: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:expression: {}
                f:priority: {}
                f:when: {}
              f:X-MaaS-Identity:
                .: {}
                f:json:
                  .: {}
                  f:properties:
                    .: {}
                    f:claims:
                      .: {}
                      f:expression: {}
                    f:source:
                      .: {}
                      f:value: {}
                f:metrics: {}
                f:priority: {}
                f:when: {}
              f:X-MaaS-KeyName:
                .: {}
                f:key: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:expression: {}
                f:priority: {}
                f:when: {}
              f:X-MaaS-Subscription:
                .: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:expression: {}
                f:priority: {}
                f:when: {}
              f:X-MaaS-Subscription-Rate-Limit-Id:
                .: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:expression: {}
                f:priority: {}
                f:when: {}
              f:X-MaaS-Username:
                .: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:selector: {}
                f:priority: {}
                f:when: {}
              f:X-MaaS-Username-Token:
                .: {}
                f:key: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:expression: {}
                f:priority: {}
                f:when: {}
              f:x-gateway-inference-fairness-id:
                .: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:expression: {}
                f:priority: {}
              f:x-gateway-inference-objective:
                .: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:expression: {}
                f:priority: {}
              f:x-llm-d-inference-fairness-id:
                .: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:expression: {}
                f:priority: {}
              f:x-llm-d-inference-objective:
                .: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:expression: {}
                f:priority: {}
              f:x-maas-organization-id:
                .: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:expression: {}
                f:priority: {}
          f:unauthenticated:
            .: {}
            f:body:
              .: {}
              f:value: {}
            f:code: {}
            f:headers:
              .: {}
              f:content-type:
                .: {}
                f:value: {}
            f:message:
              .: {}
              f:value: {}
          f:unauthorized:
            .: {}
            f:body:
              .: {}
              f:expression: {}
            f:code: {}
            f:headers:
              .: {}
              f:content-type:
                .: {}
                f:value: {}
              f:x-ext-auth-reason:
                .: {}
                f:expression: {}
    manager: manager
    operation: Update
    time: "2026-10-30T09:03:39Z"
  name: c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e
  namespace: kuadrant-system
  resourceVersion: "21440"
  uid: 645b4034-4a7c-46ac-a046-796e3bdcf5c2
spec:
  authentication:
    api-keys:
      credentials: {}
      metrics: false
      plain:
        selector: request.headers.authorization
      priority: 0
      when:
      - operator: matches
        selector: request.headers.authorization
        value: ^Bearer sk-oai-.*
    oidc-identities:
      credentials: {}
      jwt:
        issuerUrl: https://keycloak.apps.1cd0ee029a3ecc16f02f.prod.konflux-ocp-ci.dev/realms/tenant-a
        ttl: 300
      metrics: false
      priority: 1
      when:
      - predicate: '!request.headers.authorization.startsWith("Bearer sk-oai-") &&
          request.headers.authorization.matches("^Bearer [^.]+\\.[^.]+\\.[^.]+$")'
    openshift-identities:
      credentials: {}
      kubernetesTokenReview:
        audiences:
        - https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/e2e9d
      metrics: false
      priority: 2
  authorization:
    auth-valid:
      cache:
        key:
          selector: '"api-key|" + (request.headers.authorization.replace("Bearer ",
            "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 &&
            request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
            x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0]
            + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name"
            in request.headers   ? request.headers["x-gateway-model-name"]   : ""))'
        ttl: 60
      metrics: false
      opa:
        allValues: false
        rego: |-
          allow {
            object.get(input.auth.metadata, "apiKeyValidation", {})
            input.auth.metadata.apiKeyValidation.valid == true
          }
          allow {
            not input.auth.metadata.apiKeyValidation
          }
      priority: 0
    deny-api-key-management:
      metrics: false
      patternMatching:
        patterns:
        - predicate: "false"
      priority: 0
      when:
      - predicate: (request.headers.authorization.matches("^Bearer sk-oai-.*")) &&
          (request.path == "/maas-api/v1/api-keys" || request.path.startsWith("/maas-api/v1/api-keys/"))
    deny-client-identity-headers:
      metrics: false
      patternMatching:
        patterns:
        - predicate: '!("x-maas-username" in request.headers)'
        - predicate: '!("x-maas-group" in request.headers)'
        - predicate: '!("x-maas-keyname" in request.headers)'
        - predicate: '!("x-maas-subscription-rate-limit-id" in request.headers)'
        - predicate: '!("x-maas-organization-id" in request.headers)'
        - predicate: '!("x-maas-cost-center" in request.headers)'
        - predicate: '!("x-maas-identity" in request.headers)'
        - predicate: '!("x-maas-admin-scope" in request.headers)'
        - predicate: request.headers.all(name, !name.startsWith("x-aigateway-guardrail-"))
        - predicate: request.headers.all(name, !name.startsWith("x-grid-"))
      priority: 0
    guardrail-checks-known:
      metrics: false
      opa:
        allValues: false
        rego: |
          import future.keywords.every

          allow {
            selected := object.get(input.auth.metadata["subscription-info"], "selectedGuardrailChecks", null)
            selected != null
            every id, value in selected {
              id in []
              value == true
            }
          }
      priority: 0
      when:
      - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x,
          x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] !=
          "maas-api" || "x-gateway-model-name" in request.headers)
    oidc-client-bound:
      metrics: false
      patternMatching:
        patterns:
        - operator: eq
          selector: auth.identity.iss
          value: https://keycloak.apps.1cd0ee029a3ecc16f02f.prod.konflux-ocp-ci.dev/realms/tenant-a
        - operator: eq
          selector: auth.identity.azp
          value: test-client
        - predicate: has(auth.identity.aud) && (auth.identity.aud == "maas-api" ||
            "maas-api" in auth.identity.aud)
        - operator: eq
          selector: auth.identity.token_use
          value: access
      priority: 1
      when:
      - predicate: '!request.headers.authorization.startsWith("Bearer sk-oai-") &&
          request.headers.authorization.matches("^Bearer [^.]+\\.[^.]+\\.[^.]+$")
          && has(auth.identity.iss)'
    oidc-groups-safe:
      metrics: false
      opa:
        allValues: false
        rego: "unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:#._/
          -]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}"
      priority: 0
      when:
      - predicate: '!request.headers.authorization.startsWith("Bearer sk-oai-") &&
          has(auth.identity.groups) && size(auth.identity.groups) > 0'
    require-group-membership:
      cache:
        key:
          selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
            ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username)
            ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub
            : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
            ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups)
            && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ?
            auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
            g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",")
            + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ?
            auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in
            request.headers ? request.headers["x-maas-subscription"] : "")) + "|"
            + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x,
            x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] !=
            "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x,
            x != "")[1] : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   :
            ""))'
        ttl: 60
      metrics: false
      opa:
        allValues: false
        rego: |-
          allow {
            object.get(input.auth.metadata["subscription-info"], "accessAllowed", false) == true
          }
      priority: 0
      when:
      - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x,
          x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] !=
          "maas-api" || "x-gateway-model-name" in request.headers)
    subscription-valid:
      cache:
        key:
          selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
            ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username)
            ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub
            : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
            ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups)
            && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ?
            auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
            g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",")
            + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ?
            auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in
            request.headers ? request.headers["x-maas-subscription"] : "")) + "|"
            + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x,
            x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] !=
            "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x,
            x != "")[1] : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   :
            ""))'
        ttl: 60
      metrics: false
      opa:
        allValues: false
        rego: "allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\",
          \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"],
          \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"],
          \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"],
          \"deletionTimestamp\", \"\") == \"\"\n}"
      priority: 0
      when:
      - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x,
          x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] !=
          "maas-api" || "x-gateway-model-name" in request.headers)
  hosts:
  - c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e
  metadata:
    apiKeyValidation:
      cache:
        key:
          selector: auth.identity.replace("Bearer ", "")
        ttl: 60
      http:
        body:
          expression: '{"key": auth.identity.replace("Bearer ", "")}'
        contentType: application/json
        credentials: {}
        method: POST
        url: https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate
      metrics: false
      priority: 0
      when:
      - predicate: auth.identity.matches("^(Bearer )?sk-oai-.*")
    subscription-info:
      cache:
        key:
          selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
            ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username)
            ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub
            : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
            ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups)
            && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ?
            auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
            g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",")
            + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ?
            auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in
            request.headers ? request.headers["x-maas-subscription"] : "")) + "|"
            + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x,
            x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] !=
            "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x,
            x != "")[1] : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   :
            ""))'
        ttl: 60
      http:
        body:
          expression: |-
            {
              "groups": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),
              "username": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),
              "requestedSubscription": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : ""),
              "requestedModel": (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   : ""))
            }
        contentType: application/json
        credentials: {}
        method: POST
        url: https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select
      metrics: false
      priority: 1
      when:
      - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x,
          x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] !=
          "maas-api" || "x-gateway-model-name" in request.headers)
  response:
    success:
      dynamicMetadata:
        identity:
          json:
            properties:
              groups:
                expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss)
                  ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/
                  -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups)
                  && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/
                  -]+$'')) ? auth.identity.user.groups : []))'
              groups_str:
                expression: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss)
                  ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/
                  -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups)
                  && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/
                  -]+$'')) ? auth.identity.user.groups : []))).join(",")'
              keyId:
                expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.keyId : ""'
              keyName:
                expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.keyName : ""'
              selected_subscription:
                expression: 'has(auth.metadata["subscription-info"].name) ? auth.metadata["subscription-info"].name
                  : ""'
              selected_subscription_id:
                expression: 'has(auth.metadata["subscription-info"].rateLimitId) ?
                  auth.metadata["subscription-info"].rateLimitId : ""'
              selected_subscription_key:
                expression: '(has(auth.metadata["subscription-info"].namespace) &&
                  has(auth.metadata["subscription-info"].name)) ? auth.metadata["subscription-info"].namespace
                  + "/" + auth.metadata["subscription-info"].name + "@" + (has(auth.metadata["subscription-info"].resolvedModel)
                  && auth.metadata["subscription-info"].resolvedModel != "" ? auth.metadata["subscription-info"].resolvedModel
                  : (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x,
                  x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0]
                  != "maas-api" ? request.path.split("/").filter(x, x != "")[0] +
                  "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name"
                  in request.headers   ? request.headers["x-gateway-model-name"]   :
                  ""))) : ""'
              subscription_error:
                expression: 'has(auth.metadata["subscription-info"].error) ? auth.metadata["subscription-info"].error
                  : ""'
              subscription_error_message:
                expression: 'has(auth.metadata["subscription-info"].message) ? auth.metadata["subscription-info"].message
                  : ""'
              subscription_info:
                expression: 'has(auth.metadata["subscription-info"].name) ? auth.metadata["subscription-info"]
                  : {}'
              userid:
                expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username)
                  ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub
                  : auth.identity.user.username))'
          metrics: true
          priority: 0
          when:
          - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x,
              x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0]
              != "maas-api" || "x-gateway-model-name" in request.headers)
      headers:
        X-MaaS-Cost-Center:
          metrics: false
          plain:
            expression: auth.metadata["subscription-info"].costCenter
          priority: 0
          when:
          - predicate: has(auth.metadata["subscription-info"].costCenter) && auth.metadata["subscription-info"].costCenter
              != ""
        X-MaaS-Group:
          metrics: false
          plain:
            expression: 'size(auth.metadata.apiKeyValidation.groups) > 0 ? ''["''
              + auth.metadata.apiKeyValidation.groups.join(''","'') + ''"]'' : ''[]'''
          priority: 0
          when:
          - predicate: request.headers.authorization.matches("^Bearer sk-oai-.*")
        X-MaaS-Group-Token:
          key: X-MaaS-Group
          metrics: false
          plain:
            expression: 'has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups)
              > 0 && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$''))
              ? ''["system:authenticated","'' + auth.identity.groups.join(''","'')
              + ''"]'' : ''["system:authenticated"]'') : (has(auth.identity.user.groups)
              && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g,
              g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? ''["system:authenticated","''
              + auth.identity.user.groups.join(''","'') + ''"]'' : ''["system:authenticated"]'')'
          priority: 1
          when:
          - predicate: '!request.headers.authorization.startsWith("Bearer sk-oai-")'
        X-MaaS-Identity:
          json:
            properties:
              claims:
                expression: '{"iss": auth.identity.iss, "sub": auth.identity.sub,
                  "aud": auth.identity.aud, "azp": auth.identity.azp, "name": has(auth.identity.name)
                  ? auth.identity.name : "", "given_name": has(auth.identity.given_name)
                  ? auth.identity.given_name : "", "family_name": has(auth.identity.family_name)
                  ? auth.identity.family_name : "", "preferred_username": has(auth.identity.preferred_username)
                  ? auth.identity.preferred_username : "", "email": has(auth.identity.email)
                  ? auth.identity.email : "", "groups": has(auth.identity.groups)
                  ? auth.identity.groups : [], "https://redhat.com/maas/orgs": "https://redhat.com/maas/orgs"
                  in auth.identity ? auth.identity["https://redhat.com/maas/orgs"]
                  : []}'
              source:
                value: oidc
          metrics: false
          priority: 0
          when:
          - predicate: |-
              (request.path == "/v1/me" ||
              request.path == "/maas-api/v1/me" ||
              request.path == "/v1/subscriptions" ||
              request.path.startsWith("/v1/subscriptions/") ||
              request.path.startsWith("/v1/model/") && request.path.endsWith("/subscriptions") ||
              request.path.startsWith("/v1/api-keys") ||
              request.path.startsWith("/maas-api/v1/subscriptions") ||
              request.path.startsWith("/maas-api/v1/model/") && request.path.endsWith("/subscriptions") ||
              request.path.startsWith("/maas-api/v1/api-keys")) && (!request.headers.authorization.startsWith("Bearer sk-oai-") && request.headers.authorization.matches("^Bearer [^.]+\\.[^.]+\\.[^.]+$") && has(auth.identity.iss))
        X-MaaS-KeyName:
          key: x-maas-keyname
          metrics: false
          plain:
            expression: auth.metadata.apiKeyValidation.keyName
          priority: 0
          when:
          - predicate: request.headers.authorization.matches("^Bearer sk-oai-.*")
        X-MaaS-Subscription:
          metrics: false
          plain:
            expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
              ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription"
              in request.headers ? request.headers["x-maas-subscription"] : "")'
          priority: 0
          when:
          - predicate: has(auth.metadata) && has(auth.metadata.apiKeyValidation) &&
              auth.metadata.apiKeyValidation.subscription != ""
        X-MaaS-Subscription-Rate-Limit-Id:
          metrics: false
          plain:
            expression: auth.metadata["subscription-info"].rateLimitId
          priority: 0
          when:
          - predicate: has(auth.metadata["subscription-info"].rateLimitId) && auth.metadata["subscription-info"].rateLimitId
              != ""
        X-MaaS-Username:
          metrics: false
          plain:
            selector: auth.metadata.apiKeyValidation.username
          priority: 0
          when:
          - predicate: request.headers.authorization.matches("^Bearer sk-oai-.*")
        X-MaaS-Username-Token:
          key: X-MaaS-Username
          metrics: false
          plain:
            expression: 'has(auth.identity.preferred_username) ? auth.identity.preferred_username
              : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)'
          priority: 1
          when:
          - predicate: '!request.headers.authorization.startsWith("Bearer sk-oai-")'
        x-gateway-inference-fairness-id:
          metrics: false
          plain:
            expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
              && has(auth.metadata["subscription-info"].fairnessId) ? auth.metadata["subscription-info"].fairnessId
              : ""'
          priority: 0
        x-gateway-inference-objective:
          metrics: false
          plain:
            expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
              && has(auth.metadata["subscription-info"].objective) ? auth.metadata["subscription-info"].objective
              : ""'
          priority: 0
        x-llm-d-inference-fairness-id:
          metrics: false
          plain:
            expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
              && has(auth.metadata["subscription-info"].fairnessId) ? auth.metadata["subscription-info"].fairnessId
              : ""'
          priority: 0
        x-llm-d-inference-objective:
          metrics: false
          plain:
            expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
              && has(auth.metadata["subscription-info"].objective) ? auth.metadata["subscription-info"].objective
              : ""'
          priority: 0
        x-maas-organization-id:
          metrics: false
          plain:
            expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
              && has(auth.metadata["subscription-info"].organizationId) ? auth.metadata["subscription-info"].organizationId
              : ""'
          priority: 0
    unauthenticated:
      body:
        value: '{"error":{"message":"Authentication required","type":"authentication_error","code":401}}'
      code: 401
      headers:
        content-type:
          value: application/json
      message:
        value: Authentication required
    unauthorized:
      body:
        expression: '''{"error":{"message":"'' + (has(auth.metadata["subscription-info"].message)
          ? auth.metadata["subscription-info"].message.replace(''\\'', ''\\\\'').replace(''"'',
          ''\\"'').replace(''\n'', ''\\n'').replace(''\r'', ''\\r'').replace(''\t'',
          ''\\t'') : "Access denied") + ''","type":"authorization_error","code":403}}'''
      code: 403
      headers:
        content-type:
          value: application/json
        x-ext-auth-reason:
          expression: 'has(auth.metadata["subscription-info"].error) ? auth.metadata["subscription-info"].error
            : "unauthorized"'
status:
  conditions:
  - lastTransitionTime: "2026-10-30T09:03:39Z"
    reason: HostsLinked
    status: "True"
    type: Available
  - lastTransitionTime: "2026-10-30T09:03:39Z"
    reason: Reconciled
    status: "True"
    type: Ready
  summary:
    festivalWristbandEnabled: false
    hostsReady:
    - c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e
    numAuthorizationPolicies: 8
    numHostsReady: 1/1
    numIdentitySources: 3
    numMetadataSources: 2
    numResponseItems: 15
    ready: true