apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  creationTimestamp: "2026-10-30T09:01:00Z"
  generation: 2
  labels:
    app.kubernetes.io/component: gateway-auth
    app.kubernetes.io/managed-by: maas-controller
    app.kubernetes.io/part-of: maas-gateway-auth
  managedFields:
  - apiVersion: kuadrant.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:labels:
          .: {}
          f:app.kubernetes.io/component: {}
          f:app.kubernetes.io/managed-by: {}
          f:app.kubernetes.io/part-of: {}
        f:ownerReferences:
          .: {}
          k:{"uid":"8ddbcb18-3af4-49c0-86bd-0c4526e5e08b"}: {}
      f:spec:
        .: {}
        f:defaults:
          .: {}
          f:rules:
            .: {}
            f:authentication:
              .: {}
              f:api-keys:
                .: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:selector: {}
                f:priority: {}
                f:when: {}
              f:oidc-identities:
                .: {}
                f:jwt:
                  .: {}
                  f:issuerUrl: {}
                  f:ttl: {}
                f:metrics: {}
                f:priority: {}
                f:when: {}
              f:openshift-identities:
                .: {}
                f:kubernetesTokenReview:
                  .: {}
                  f:audiences: {}
                f:metrics: {}
                f:priority: {}
            f:authorization:
              .: {}
              f:auth-valid:
                .: {}
                f:cache:
                  .: {}
                  f:key:
                    .: {}
                    f:selector: {}
                  f:ttl: {}
                f:metrics: {}
                f:opa:
                  .: {}
                  f:allValues: {}
                  f:rego: {}
                f:priority: {}
              f:deny-api-key-management:
                .: {}
                f:metrics: {}
                f:patternMatching:
                  .: {}
                  f:patterns: {}
                f:priority: {}
                f:when: {}
              f:deny-client-identity-headers:
                .: {}
                f:metrics: {}
                f:patternMatching:
                  .: {}
                  f:patterns: {}
                f:priority: {}
              f:guardrail-checks-known:
                .: {}
                f:metrics: {}
                f:opa:
                  .: {}
                  f:allValues: {}
                  f:rego: {}
                f:priority: {}
                f:when: {}
              f:oidc-client-bound:
                .: {}
                f:metrics: {}
                f:patternMatching:
                  .: {}
                  f:patterns: {}
                f:priority: {}
                f:when: {}
              f:oidc-groups-safe:
                .: {}
                f:metrics: {}
                f:opa:
                  .: {}
                  f:allValues: {}
                  f:rego: {}
                f:priority: {}
                f:when: {}
              f:require-group-membership:
                .: {}
                f:cache:
                  .: {}
                  f:key:
                    .: {}
                    f:selector: {}
                  f:ttl: {}
                f:metrics: {}
                f:opa:
                  .: {}
                  f:allValues: {}
                  f:rego: {}
                f:priority: {}
                f:when: {}
              f:subscription-valid:
                .: {}
                f:cache:
                  .: {}
                  f:key:
                    .: {}
                    f:selector: {}
                  f:ttl: {}
                f:metrics: {}
                f:opa:
                  .: {}
                  f:allValues: {}
                  f:rego: {}
                f:priority: {}
                f:when: {}
            f:metadata:
              .: {}
              f:apiKeyValidation:
                .: {}
                f:cache:
                  .: {}
                  f:key:
                    .: {}
                    f:selector: {}
                  f:ttl: {}
                f:http:
                  .: {}
                  f:body:
                    .: {}
                    f:expression: {}
                  f:contentType: {}
                  f:method: {}
                  f:url: {}
                f:metrics: {}
                f:priority: {}
                f:when: {}
              f:subscription-info:
                .: {}
                f:cache:
                  .: {}
                  f:key:
                    .: {}
                    f:selector: {}
                  f:ttl: {}
                f:http:
                  .: {}
                  f:body:
                    .: {}
                    f:expression: {}
                  f:contentType: {}
                  f:method: {}
                  f:url: {}
                f:metrics: {}
                f:priority: {}
                f:when: {}
            f:response:
              .: {}
              f:success:
                .: {}
                f:filters:
                  .: {}
                  f:identity:
                    .: {}
                    f:json:
                      .: {}
                      f:properties:
                        .: {}
                        f:groups:
                          .: {}
                          f:expression: {}
                        f:groups_str:
                          .: {}
                          f:expression: {}
                        f:keyId:
                          .: {}
                          f:expression: {}
                        f:keyName:
                          .: {}
                          f:expression: {}
                        f:selected_subscription:
                          .: {}
                          f:expression: {}
                        f:selected_subscription_id:
                          .: {}
                          f:expression: {}
                        f:selected_subscription_key:
                          .: {}
                          f:expression: {}
                        f:subscription_error:
                          .: {}
                          f:expression: {}
                        f:subscription_error_message:
                          .: {}
                          f:expression: {}
                        f:subscription_info:
                          .: {}
                          f:expression: {}
                        f:userid:
                          .: {}
                          f:expression: {}
                    f:metrics: {}
                    f:priority: {}
                    f:when: {}
                f:headers:
                  .: {}
                  f:X-MaaS-Cost-Center:
                    .: {}
                    f:metrics: {}
                    f:plain:
                      .: {}
                      f:expression: {}
                    f:priority: {}
                    f:when: {}
                  f:X-MaaS-Group:
                    .: {}
                    f:metrics: {}
                    f:plain:
                      .: {}
                      f:expression: {}
                    f:priority: {}
                    f:when: {}
                  f:X-MaaS-Group-Token:
                    .: {}
                    f:key: {}
                    f:metrics: {}
                    f:plain:
                      .: {}
                      f:expression: {}
                    f:priority: {}
                    f:when: {}
                  f:X-MaaS-Identity:
                    .: {}
                    f:json:
                      .: {}
                      f:properties:
                        .: {}
                        f:claims:
                          .: {}
                          f:expression: {}
                        f:source:
                          .: {}
                          f:value: {}
                    f:metrics: {}
                    f:priority: {}
                    f:when: {}
                  f:X-MaaS-KeyName:
                    .: {}
                    f:key: {}
                    f:metrics: {}
                    f:plain:
                      .: {}
                      f:expression: {}
                    f:priority: {}
                    f:when: {}
                  f:X-MaaS-Subscription:
                    .: {}
                    f:metrics: {}
                    f:plain:
                      .: {}
                      f:expression: {}
                    f:priority: {}
                    f:when: {}
                  f:X-MaaS-Subscription-Rate-Limit-Id:
                    .: {}
                    f:metrics: {}
                    f:plain:
                      .: {}
                      f:expression: {}
                    f:priority: {}
                    f:when: {}
                  f:X-MaaS-Username:
                    .: {}
                    f:metrics: {}
                    f:plain:
                      .: {}
                      f:selector: {}
                    f:priority: {}
                    f:when: {}
                  f:X-MaaS-Username-Token:
                    .: {}
                    f:key: {}
                    f:metrics: {}
                    f:plain:
                      .: {}
                      f:expression: {}
                    f:priority: {}
                    f:when: {}
                  f:x-gateway-inference-fairness-id:
                    .: {}
                    f:metrics: {}
                    f:plain:
                      .: {}
                      f:expression: {}
                    f:priority: {}
                  f:x-gateway-inference-objective:
                    .: {}
                    f:metrics: {}
                    f:plain:
                      .: {}
                      f:expression: {}
                    f:priority: {}
                  f:x-llm-d-inference-fairness-id:
                    .: {}
                    f:metrics: {}
                    f:plain:
                      .: {}
                      f:expression: {}
                    f:priority: {}
                  f:x-llm-d-inference-objective:
                    .: {}
                    f:metrics: {}
                    f:plain:
                      .: {}
                      f:expression: {}
                    f:priority: {}
                  f:x-maas-organization-id:
                    .: {}
                    f:metrics: {}
                    f:plain:
                      .: {}
                      f:expression: {}
                    f:priority: {}
              f:unauthenticated:
                .: {}
                f:body:
                  .: {}
                  f:value: {}
                f:code: {}
                f:headers:
                  .: {}
                  f:content-type:
                    .: {}
                    f:value: {}
                f:message:
                  .: {}
                  f:value: {}
              f:unauthorized:
                .: {}
                f:body:
                  .: {}
                  f:expression: {}
                f:code: {}
                f:headers:
                  .: {}
                  f:content-type:
                    .: {}
                    f:value: {}
                  f:x-ext-auth-reason:
                    .: {}
                    f:expression: {}
          f:strategy: {}
          f:when: {}
        f:targetRef:
          .: {}
          f:group: {}
          f:kind: {}
          f:name: {}
    manager: manager
    operation: Update
    time: "2026-10-30T09:03:29Z"
  - apiVersion: kuadrant.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        .: {}
        f:conditions:
          .: {}
          k:{"type":"Accepted"}:
            .: {}
            f:lastTransitionTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
          k:{"type":"Enforced"}:
            .: {}
            f:lastTransitionTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
        f:observedGeneration: {}
    manager: manager
    operation: Update
    subresource: status
    time: "2026-10-30T09:09:23Z"
  name: maas-gateway-auth
  namespace: openshift-ingress
  ownerReferences:
  - apiVersion: gateway.networking.k8s.io/v1
    controller: true
    kind: Gateway
    name: maas-default-gateway
    uid: 8ddbcb18-3af4-49c0-86bd-0c4526e5e08b
  resourceVersion: "30111"
  uid: 4d2f1082-e7df-43c7-98be-94732059c3df
spec:
  defaults:
    rules:
      authentication:
        api-keys:
          metrics: false
          plain:
            selector: request.headers.authorization
          priority: 0
          when:
          - operator: matches
            selector: request.headers.authorization
            value: ^Bearer sk-oai-.*
        oidc-identities:
          jwt:
            issuerUrl: https://keycloak.apps.1cd0ee029a3ecc16f02f.prod.konflux-ocp-ci.dev/realms/tenant-a
            ttl: 300
          metrics: false
          priority: 1
          when:
          - predicate: '!request.headers.authorization.startsWith("Bearer sk-oai-")
              && request.headers.authorization.matches("^Bearer [^.]+\\.[^.]+\\.[^.]+$")'
        openshift-identities:
          kubernetesTokenReview:
            audiences:
            - https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/e2e9d
          metrics: false
          priority: 2
      authorization:
        auth-valid:
          cache:
            key:
              selector: '"api-key|" + (request.headers.authorization.replace("Bearer
                ", "")) + "|" + (size(request.path.split("/").filter(x, x != ""))
                >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x !=
                "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name"
                in request.headers   ? request.headers["x-gateway-model-name"]   :
                ""))'
            ttl: 60
          metrics: false
          opa:
            allValues: false
            rego: |-
              allow {
                object.get(input.auth.metadata, "apiKeyValidation", {})
                input.auth.metadata.apiKeyValidation.valid == true
              }
              allow {
                not input.auth.metadata.apiKeyValidation
              }
          priority: 0
        deny-api-key-management:
          metrics: false
          patternMatching:
            patterns:
            - predicate: "false"
          priority: 0
          when:
          - predicate: (request.headers.authorization.matches("^Bearer sk-oai-.*"))
              && (request.path == "/maas-api/v1/api-keys" || request.path.startsWith("/maas-api/v1/api-keys/"))
        deny-client-identity-headers:
          metrics: false
          patternMatching:
            patterns:
            - predicate: '!("x-maas-username" in request.headers)'
            - predicate: '!("x-maas-group" in request.headers)'
            - predicate: '!("x-maas-keyname" in request.headers)'
            - predicate: '!("x-maas-subscription-rate-limit-id" in request.headers)'
            - predicate: '!("x-maas-organization-id" in request.headers)'
            - predicate: '!("x-maas-cost-center" in request.headers)'
            - predicate: '!("x-maas-identity" in request.headers)'
            - predicate: '!("x-maas-admin-scope" in request.headers)'
            - predicate: request.headers.all(name, !name.startsWith("x-aigateway-guardrail-"))
            - predicate: request.headers.all(name, !name.startsWith("x-grid-"))
          priority: 0
        guardrail-checks-known:
          metrics: false
          opa:
            allValues: false
            rego: |
              import future.keywords.every

              allow {
                selected := object.get(input.auth.metadata["subscription-info"], "selectedGuardrailChecks", null)
                selected != null
                every id, value in selected {
                  id in []
                  value == true
                }
              }
          priority: 0
          when:
          - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x,
              x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0]
              != "maas-api" || "x-gateway-model-name" in request.headers)
        oidc-client-bound:
          metrics: false
          patternMatching:
            patterns:
            - operator: eq
              selector: auth.identity.iss
              value: https://keycloak.apps.1cd0ee029a3ecc16f02f.prod.konflux-ocp-ci.dev/realms/tenant-a
            - operator: eq
              selector: auth.identity.azp
              value: test-client
            - predicate: has(auth.identity.aud) && (auth.identity.aud == "maas-api"
                || "maas-api" in auth.identity.aud)
            - operator: eq
              selector: auth.identity.token_use
              value: access
          priority: 1
          when:
          - predicate: '!request.headers.authorization.startsWith("Bearer sk-oai-")
              && request.headers.authorization.matches("^Bearer [^.]+\\.[^.]+\\.[^.]+$")
              && has(auth.identity.iss)'
        oidc-groups-safe:
          metrics: false
          opa:
            allValues: false
            rego: "unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot
              regex.match(\"^[A-Za-z0-9:#._/ -]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group)
              == 0\n}"
          priority: 0
          when:
          - predicate: '!request.headers.authorization.startsWith("Bearer sk-oai-")
              && has(auth.identity.groups) && size(auth.identity.groups) > 0'
        require-group-membership:
          cache:
            key:
              selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username)
                ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub
                : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss)
                ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/
                -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups)
                && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$''))
                ? auth.identity.user.groups : []))).join(",") + "|" + ((has(auth.metadata)
                && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription
                : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"]
                : "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >=
                2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x !=
                "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name"
                in request.headers   ? request.headers["x-gateway-model-name"]   :
                ""))'
            ttl: 60
          metrics: false
          opa:
            allValues: false
            rego: |-
              allow {
                object.get(input.auth.metadata["subscription-info"], "accessAllowed", false) == true
              }
          priority: 0
          when:
          - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x,
              x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0]
              != "maas-api" || "x-gateway-model-name" in request.headers)
        subscription-valid:
          cache:
            key:
              selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username)
                ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub
                : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss)
                ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/
                -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups)
                && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$''))
                ? auth.identity.user.groups : []))).join(",") + "|" + ((has(auth.metadata)
                && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription
                : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"]
                : "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >=
                2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x !=
                "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name"
                in request.headers   ? request.headers["x-gateway-model-name"]   :
                ""))'
            ttl: 60
          metrics: false
          opa:
            allValues: false
            rego: "allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"],
              \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"],
              \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"],
              \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"],
              \"deletionTimestamp\", \"\") == \"\"\n}"
          priority: 0
          when:
          - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x,
              x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0]
              != "maas-api" || "x-gateway-model-name" in request.headers)
      metadata:
        apiKeyValidation:
          cache:
            key:
              selector: auth.identity.replace("Bearer ", "")
            ttl: 60
          http:
            body:
              expression: '{"key": auth.identity.replace("Bearer ", "")}'
            contentType: application/json
            method: POST
            url: https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate
          metrics: false
          priority: 0
          when:
          - predicate: auth.identity.matches("^(Bearer )?sk-oai-.*")
        subscription-info:
          cache:
            key:
              selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username)
                ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub
                : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss)
                ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/
                -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups)
                && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$''))
                ? auth.identity.user.groups : []))).join(",") + "|" + ((has(auth.metadata)
                && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription
                : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"]
                : "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >=
                2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x !=
                "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name"
                in request.headers   ? request.headers["x-gateway-model-name"]   :
                ""))'
            ttl: 60
          http:
            body:
              expression: |-
                {
                  "groups": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),
                  "username": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),
                  "requestedSubscription": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : ""),
                  "requestedModel": (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   : ""))
                }
            contentType: application/json
            method: POST
            url: https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select
          metrics: false
          priority: 1
          when:
          - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x,
              x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0]
              != "maas-api" || "x-gateway-model-name" in request.headers)
      response:
        success:
          filters:
            identity:
              json:
                properties:
                  groups:
                    expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                      ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss)
                      ? (has(auth.identity.groups) && auth.identity.groups.all(g,
                      g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups
                      : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
                      g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups
                      : []))'
                  groups_str:
                    expression: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                      ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss)
                      ? (has(auth.identity.groups) && auth.identity.groups.all(g,
                      g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups
                      : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
                      g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups
                      : []))).join(",")'
                  keyId:
                    expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                      ? auth.metadata.apiKeyValidation.keyId : ""'
                  keyName:
                    expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                      ? auth.metadata.apiKeyValidation.keyName : ""'
                  selected_subscription:
                    expression: 'has(auth.metadata["subscription-info"].name) ? auth.metadata["subscription-info"].name
                      : ""'
                  selected_subscription_id:
                    expression: 'has(auth.metadata["subscription-info"].rateLimitId)
                      ? auth.metadata["subscription-info"].rateLimitId : ""'
                  selected_subscription_key:
                    expression: '(has(auth.metadata["subscription-info"].namespace)
                      && has(auth.metadata["subscription-info"].name)) ? auth.metadata["subscription-info"].namespace
                      + "/" + auth.metadata["subscription-info"].name + "@" + (has(auth.metadata["subscription-info"].resolvedModel)
                      && auth.metadata["subscription-info"].resolvedModel != "" ?
                      auth.metadata["subscription-info"].resolvedModel : (size(request.path.split("/").filter(x,
                      x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0]
                      != "v1" && request.path.split("/").filter(x, x != "")[0] !=
                      "maas-api" ? request.path.split("/").filter(x, x != "")[0] +
                      "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name"
                      in request.headers   ? request.headers["x-gateway-model-name"]   :
                      ""))) : ""'
                  subscription_error:
                    expression: 'has(auth.metadata["subscription-info"].error) ? auth.metadata["subscription-info"].error
                      : ""'
                  subscription_error_message:
                    expression: 'has(auth.metadata["subscription-info"].message) ?
                      auth.metadata["subscription-info"].message : ""'
                  subscription_info:
                    expression: 'has(auth.metadata["subscription-info"].name) ? auth.metadata["subscription-info"]
                      : {}'
                  userid:
                    expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                      ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username)
                      ? auth.identity.preferred_username : (has(auth.identity.sub)
                      ? auth.identity.sub : auth.identity.user.username))'
              metrics: true
              priority: 0
              when:
              - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2
                  && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                  x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers)
          headers:
            X-MaaS-Cost-Center:
              metrics: false
              plain:
                expression: auth.metadata["subscription-info"].costCenter
              priority: 0
              when:
              - predicate: has(auth.metadata["subscription-info"].costCenter) && auth.metadata["subscription-info"].costCenter
                  != ""
            X-MaaS-Group:
              metrics: false
              plain:
                expression: 'size(auth.metadata.apiKeyValidation.groups) > 0 ? ''["''
                  + auth.metadata.apiKeyValidation.groups.join(''","'') + ''"]'' :
                  ''[]'''
              priority: 0
              when:
              - predicate: request.headers.authorization.matches("^Bearer sk-oai-.*")
            X-MaaS-Group-Token:
              key: X-MaaS-Group
              metrics: false
              plain:
                expression: 'has(auth.identity.iss) ? (has(auth.identity.groups) &&
                  size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/
                  -]+$'')) ? ''["system:authenticated","'' + auth.identity.groups.join(''","'')
                  + ''"]'' : ''["system:authenticated"]'') : (has(auth.identity.user.groups)
                  && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g,
                  g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? ''["system:authenticated","''
                  + auth.identity.user.groups.join(''","'') + ''"]'' : ''["system:authenticated"]'')'
              priority: 1
              when:
              - predicate: '!request.headers.authorization.startsWith("Bearer sk-oai-")'
            X-MaaS-Identity:
              json:
                properties:
                  claims:
                    expression: '{"iss": auth.identity.iss, "sub": auth.identity.sub,
                      "aud": auth.identity.aud, "azp": auth.identity.azp, "name":
                      has(auth.identity.name) ? auth.identity.name : "", "given_name":
                      has(auth.identity.given_name) ? auth.identity.given_name : "",
                      "family_name": has(auth.identity.family_name) ? auth.identity.family_name
                      : "", "preferred_username": has(auth.identity.preferred_username)
                      ? auth.identity.preferred_username : "", "email": has(auth.identity.email)
                      ? auth.identity.email : "", "groups": has(auth.identity.groups)
                      ? auth.identity.groups : [], "https://redhat.com/maas/orgs":
                      "https://redhat.com/maas/orgs" in auth.identity ? auth.identity["https://redhat.com/maas/orgs"]
                      : []}'
                  source:
                    value: oidc
              metrics: false
              priority: 0
              when:
              - predicate: |-
                  (request.path == "/v1/me" ||
                  request.path == "/maas-api/v1/me" ||
                  request.path == "/v1/subscriptions" ||
                  request.path.startsWith("/v1/subscriptions/") ||
                  request.path.startsWith("/v1/model/") && request.path.endsWith("/subscriptions") ||
                  request.path.startsWith("/v1/api-keys") ||
                  request.path.startsWith("/maas-api/v1/subscriptions") ||
                  request.path.startsWith("/maas-api/v1/model/") && request.path.endsWith("/subscriptions") ||
                  request.path.startsWith("/maas-api/v1/api-keys")) && (!request.headers.authorization.startsWith("Bearer sk-oai-") && request.headers.authorization.matches("^Bearer [^.]+\\.[^.]+\\.[^.]+$") && has(auth.identity.iss))
            X-MaaS-KeyName:
              key: x-maas-keyname
              metrics: false
              plain:
                expression: auth.metadata.apiKeyValidation.keyName
              priority: 0
              when:
              - predicate: request.headers.authorization.matches("^Bearer sk-oai-.*")
            X-MaaS-Subscription:
              metrics: false
              plain:
                expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription"
                  in request.headers ? request.headers["x-maas-subscription"] : "")'
              priority: 0
              when:
              - predicate: has(auth.metadata) && has(auth.metadata.apiKeyValidation)
                  && auth.metadata.apiKeyValidation.subscription != ""
            X-MaaS-Subscription-Rate-Limit-Id:
              metrics: false
              plain:
                expression: auth.metadata["subscription-info"].rateLimitId
              priority: 0
              when:
              - predicate: has(auth.metadata["subscription-info"].rateLimitId) &&
                  auth.metadata["subscription-info"].rateLimitId != ""
            X-MaaS-Username:
              metrics: false
              plain:
                selector: auth.metadata.apiKeyValidation.username
              priority: 0
              when:
              - predicate: request.headers.authorization.matches("^Bearer sk-oai-.*")
            X-MaaS-Username-Token:
              key: X-MaaS-Username
              metrics: false
              plain:
                expression: 'has(auth.identity.preferred_username) ? auth.identity.preferred_username
                  : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)'
              priority: 1
              when:
              - predicate: '!request.headers.authorization.startsWith("Bearer sk-oai-")'
            x-gateway-inference-fairness-id:
              metrics: false
              plain:
                expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                  && has(auth.metadata["subscription-info"].fairnessId) ? auth.metadata["subscription-info"].fairnessId
                  : ""'
              priority: 0
            x-gateway-inference-objective:
              metrics: false
              plain:
                expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                  && has(auth.metadata["subscription-info"].objective) ? auth.metadata["subscription-info"].objective
                  : ""'
              priority: 0
            x-llm-d-inference-fairness-id:
              metrics: false
              plain:
                expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                  && has(auth.metadata["subscription-info"].fairnessId) ? auth.metadata["subscription-info"].fairnessId
                  : ""'
              priority: 0
            x-llm-d-inference-objective:
              metrics: false
              plain:
                expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                  && has(auth.metadata["subscription-info"].objective) ? auth.metadata["subscription-info"].objective
                  : ""'
              priority: 0
            x-maas-organization-id:
              metrics: false
              plain:
                expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                  && has(auth.metadata["subscription-info"].organizationId) ? auth.metadata["subscription-info"].organizationId
                  : ""'
              priority: 0
        unauthenticated:
          body:
            value: '{"error":{"message":"Authentication required","type":"authentication_error","code":401}}'
          code: 401
          headers:
            content-type:
              value: application/json
          message:
            value: Authentication required
        unauthorized:
          body:
            expression: '''{"error":{"message":"'' + (has(auth.metadata["subscription-info"].message)
              ? auth.metadata["subscription-info"].message.replace(''\\'', ''\\\\'').replace(''"'',
              ''\\"'').replace(''\n'', ''\\n'').replace(''\r'', ''\\r'').replace(''\t'',
              ''\\t'') : "Access denied") + ''","type":"authorization_error","code":403}}'''
          code: 403
          headers:
            content-type:
              value: application/json
            x-ext-auth-reason:
              expression: 'has(auth.metadata["subscription-info"].error) ? auth.metadata["subscription-info"].error
                : "unauthorized"'
    strategy: atomic
    when:
    - predicate: request.path != "/maas-api/health" || request.method != "GET"
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: maas-default-gateway
status:
  conditions:
  - lastTransitionTime: "2026-10-30T09:01:00Z"
    message: AuthPolicy has been accepted
    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: "2026-10-30T09:09:23Z"
    message: AuthPolicy has been successfully enforced
    reason: Enforced
    status: "True"
    type: Enforced
  observedGeneration: 2